app-update.sh

#!/bin/sh
# app-update.sh - Update application from git
# SPDX-License-Identifier: MIT (https://ncurl.xyz/s/Kkn2DQsNR)

set -e

APP_NAME="$(basename $PWD)"
if [ -z "$APP_NAME" ]; then
  echo "APP_NAME is empty."
  exit 1
fi

git pull origin main

if [ -f "package.json" ]; then
  npm install
fi

RC_SERVICE="/sbin/rc-service"
doas "$RC_SERVICE" "$APP_NAME" restart

app.openrc

#!/sbin/openrc-run
# Example Application Service OpenRC
# SPDX-License-Identifier: MIT (https://ncurl.xyz/s/Kkn2DQsNR)

name=$RC_SVCNAME
supervisor="supervise-daemon"

command="/usr/bin/node"
command_args="app.ts"
command_user="appuser"
supervise_daemon_args=" -d /srv/myapp"

respawn_delay=5
respawn_max=0

depend() {
        after net 
}

doas.conf

# /etc/doas.d/75-webhook.conf
# SPDX-License-Identifier: MIT (https://ncurl.xyz/s/Kkn2DQsNR)

permit nopass appuser as root cmd /sbin/rc-service

gen-secret.sh

#!/bin/sh
# gen-secret.sh - Generate webhook secret for validation
# SPDX-License-Identifier: MIT (https://ncurl.xyz/s/Kkn2DQsNR)

set -e

openssl rand -hex 16

hooks.yaml

# /etc/webhook/hooks.yaml
# SPDX-License-Identifier: MIT (https://ncurl.xyz/s/Kkn2DQsNR)

- id: myapp@update
  command-working-directory: "/srv/myapp"
  execute-command: "/etc/webhook/scripts/app-update.sh"
  trigger-rule: 
    match:
      type: value
      value: app-update-secret # openssl rand -hex 16
      parameter:
        source: url
        name: secret

webhook.openrc

#!/sbin/openrc-run
# Webhook - https://github.com/adnanh/webhook
# SPDX-License-Identifier: MIT (https://ncurl.xyz/s/Kkn2DQsNR)

name=$RC_SVCNAME
description="The webhook daemon (https://github.com/adnanh/webhook)"
supervisor="supervise-daemon"

command="/usr/bin/webhook"
command_args="-hooks /etc/webhook/hooks.yaml -logfile /var/log/$name.log -nopanic -ip 127.0.0.1 -port 9000"
command_user="appuser"
supervise_daemon_args=" -d /etc/webhook"

respawn_delay=5
respawn_max=0

depend() {
        after net 
}

start_pre() {
  checkpath -f -m 0644 -o "$command_user:$command_user" "/var/log/$name.log"
}